Skip to Content
Workspace SettingsCompliance and Consent

Compliance And Consent

console.sophosic.ai
Inbox12 open
New intake formNew
Portal ticketLinked
PortalNext bookingInvoice and ticket history
Customer operationsCustomer records, inbox work, portal state, communications, and consent

Compliance settings shape what customers agree to, what operators can send, and what records are retained for future customer work. Treat these settings as launch-critical when a workspace accepts payments, bookings, intake forms, marketing subscriptions, waivers, or support requests.

Source Of Truth

Configure legal, consent, sender, and intake posture in console. Verify the customer-facing result on sites in checkout, booking, forms, portal preferences, email unsubscribe, policies, and waiver flows.

Surfaces

Need

Terms and privacy

Console surface: Settings > Privacy and Legal

Sites surface: Policies, checkout, account portal

Need

Refunds and cancellations

Console surface: Policies, Checkout and Tax, Scheduling

Sites surface: Checkout, booking confirmation, manage booking

Need

Shipping policy

Console surface: Policies, Shipping

Sites surface: Product detail, checkout, order tracking

Need

Cookie consent

Console surface: Settings > Cookie Consent, Integrations

Sites surface: Analytics and ads tag behavior

Need

Email consent

Console surface: Communications, Subscribers, portal preferences

Sites surface: Email preferences, unsubscribe, notification preferences

Need

Booking waivers

Console surface: Consent Documents, Services

Sites surface: Booking waiver step, booking detail

Need

Intake consent

Console surface: Intake Flow, Forms

Sites surface: Intake forms, contact forms, booking questions

Need

Customer records

Console surface: Customers, forms, bookings, orders, tickets

Sites surface: Portal profile, orders, bookings, tickets

Launch Checklist

Before Enabling Real Customer Traffic

  • Published policy pages match the workspace’s actual business practices.
  • Checkout, booking, form, and portal links all point to the production domain.
  • Required consent is presented before the customer action completes.
  • Email templates use the correct sender, reply-to, unsubscribe, and preference links.
  • Analytics and ads tags respect the workspace’s cookie consent posture.
  • Waiver requirements are attached only to services that need them.
  • Intake questions collect enough context without blocking low-risk actions.
  • Operators know where consent evidence appears in customer, booking, and order records.

  1. Product checkout

    What to verify: Terms, refund policy, shipping policy, tax display, payment authorization, receipt link

  2. Booking

    What to verify: Cancellation policy, waiver, deposit terms, intake questions, confirmation copy

  3. Form submission

    What to verify: Purpose of collection, required fields, communication expectation, confirmation state

  4. Customer portal

    What to verify: Profile data, notification preferences, tickets, saved items, billing and order visibility

  5. Marketing email

    What to verify: Subscription state, unsubscribe route, sender identity, campaign attribution

  6. Support ticket

    What to verify: Customer identity, message history, operator reply path, escalation expectation

Operator Protocol

  1. Identify the customer action that collects data or creates an obligation.
  2. Confirm which policy, waiver, or consent language applies.
  3. Attach the requirement in the console source-of-truth surface.
  4. Test the public flow through completion or the approved payment boundary.
  5. Confirm the resulting console record includes the right customer context.
  6. Confirm customer email and portal links reflect the same policy.

Common Gaps

Gap

Policy pages exist but are not linked

Risk: Customers complete high-risk actions without seeing terms

Fix: Add links in navigation, footer, checkout, and booking flows

Gap

Consent appears after completion

Risk: Agreement is poorly timed

Fix: Move required consent before the order, booking, or submission finalizes

Gap

Waiver attached to every service

Risk: Low-risk flows feel heavy

Fix: Attach waivers only to services that require them

Gap

Marketing consent mixed with service notifications

Risk: Customers cannot distinguish required and optional messages

Fix: Separate transactional notifications from marketing subscriptions

Gap

Wrong reply-to address

Risk: Customer replies miss the operator team

Fix: Fix Domain and Email and retest notification templates

Gap

Cookie consent conflicts with ads

Risk: Tracking fires before consent or never fires after consent

Fix: Review Google integrations and consent settings together

Troubleshooting

Customer says they never agreed

Customer record, booking/order record, form submission, waiver record

Unsubscribe link fails

Email preference route, subscriber record, token, production domain

Waiver missing from booking

Service consent requirements, public booking step order, booking detail

Checkout policy link is wrong

Checkout settings, policy page slug, domain routing

Ads tracking unexpected

Cookie consent, Google Ads integration, conversion event trigger

Customer portal exposes wrong data

Customer ownership, workspace scope, portal auth state

Use these pages when compliance behavior depends on launch setup, customer operations, customer-facing testing, or symptom-based investigation. Consent problems usually cross more than one surface, so follow the flow guide and then verify the public path where the customer sees the language.

Compliance and Consent | Sophosic Platform